Critical PHP Vulnerabilities: October 2026 Security Updates
Original public advisory date: 21 October 2026
Publication date: 22 October 2026
PHP released security updates on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities that can allow unauthenticated remote code execution. Administrators should identify affected runtimes and apply the fixes promptly. These are PHP runtime issues; updating an application or framework alone does not replace updating PHP. See the official PHP security announcement.
What the vulnerabilities do
CVE-2026-109618: RCE via OOM corruption concerns out-of-memory handling. An allocation failure can interrupt PHP while internal request data is only partly initialized. Cleanup may subsequently treat that invalid data as valid, causing memory corruption. The advisory confirms remote code execution as the web worker account, demonstrated over HTTP against Apache mod_php with default PHP input and memory limits.
CVE-2026-109619: RCE via stale global state involves worker state that retains references to freed request memory. A later request handled by the same worker can access that stale state before normal initialization resets it. Exploitation requires a reachable operation that leaves state behind and another that consumes it. The advisory documents confirmed mod_php exploitation involving PHP 8.5 fatal-error backtraces and specific request-initialization conditions.
Successful code execution can compromise resources accessible to the worker account. It does not automatically imply administrator or root access.
Configuration changes the attack paths
PHP identifies installations serving web requests as at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. This does not establish identical exploitability across those environments.
For CVE-2026-109618, mod_php can reach the vulnerable cleanup before application code runs. FPM terminates a child when request startup fails, blocking that particular sequence; application-stage paths remain a concern. For CVE-2026-109619, FPM exposure depends on suitable state-producing and consuming operations. Application behavior, extensions and configuration matter.
The PHP Foundation’s disclosure account describes demonstrated exploits. Demonstrations establish practical impact under tested conditions, but are not evidence of attacks against production systems. The reviewed official sources do not establish confirmed exploitation in the wild; circulating proofs of concept and warnings about likely attacks should not be presented as that confirmation.
Affected and fixed versions
Both official GitHub advisories identify these affected supported branches and first fixed releases:
| PHP branch | Affected releases | First fixed release |
|---|---|---|
| 8.2 | Earlier than 8.2.35 | 8.2.35 |
| 8.3 | Earlier than 8.3.36 | 8.3.36 |
| 8.4 | Earlier than 8.4.27 | 8.4.27 |
| 8.5 | Earlier than 8.5.12 | 8.5.12 |
PHP 8.1 and older are outside regular upstream support. PHP provided exceptional minimal source backports for 7.4, 8.0 and 8.1; some distribution and LTS vendors also supply fixes. Confirm vendor package status rather than judging a backported package solely by its upstream version number.
Recommended actions
- Inventory PHP services, hosting accounts and container images; prioritize internet-facing applications.
- Install a fixed upstream release or a vendor-confirmed patched package. Coordinate managed hosting updates with the provider.
- Restart affected workers or redeploy updated containers, verify the running runtime, and check application operation.
- If patching must wait, follow CERT-EU’s advisory, including considering temporary isolation of exposed services. PHP’s configuration mitigations cover specific paths only. An update is the complete fix.